← All threat actors
BPFDoormalware / toolS1161 ↗
BPFDoor is a Linux based passive long-term backdoor used by China-based threat actors. First seen in 2021, BPFDoor is named after its usage of Berkley Packet Filter (BPF) to execute single task instructions.
Reports / IOCs (VT)
80 reports · 0 IOCs
Reported activity
2022 – 2026
Used by
ATT&CK techniques in reports
- T1205 Traffic Signaling6
- T1205.002 Socket Filters4
- T1059.004 Unix Shell4
- T1027 Obfuscated Files or Information3
- T1036.004 Masquerade Task or Service3
- T1070.003 Clear Command History3
- T1090 Proxy3
- T1573.001 Symmetric Cryptography3
- T1078 Valid Accounts2
- T1190 Exploit Public-Facing Application2
- T1106 Native API2
- T1001 Data Obfuscation2
- T1071.001 Web Protocols2
- T1095 Non-Application Layer Protocol2
- T1564 Hide Artifacts2
- T1572 Protocol Tunneling2
- T1059 Command and Scripting Interpreter2
- T1480.002 Mutual Exclusion1
- T1573 Encrypted Channel1
- T1027.011 Fileless Storage1
Also known as
JustForFun